!16 [sync] PR-14: replace undefined bit shifts, fix CVE-2024-56431

From: @openeuler-sync-bot 
Reviewed-by: @dillon_chen 
Signed-off-by: @dillon_chen

backport-fix-CVE-2024-56431.patch

@@ -0,0 +1,228 @@
+From a6766c94721bc55e8e56fb0d941ecfe2d27c3d17 Mon Sep 17 00:00:00 2001
+From: Petter Reinholdtsen <pere@debian.org>
+Date: Sun, 9 Mar 2025 08:07:49 +0100
+Subject: [PATCH 1/3] Replaced possible bit shifting into signed bit of stride
+ values.
+
+Use multiplication instead, allowing the compiler to optimize to
+bitshifts if it believe it to be safe.
+
+Partly solves github issue #18.
+
+Backported to 1.1.1 by <wangshuo@kylinos.cn>, fix CVE-2024-56431
+https://github.com/xiph/theora/commit/a6766c94721bc55e8e56fb0d941ecfe2d27c3d17
+---
+ lib/decode.c      | 14 +++++++-------
+ lib/state.c       |  4 ++--
+ lib/x86/mmxfrag.c |  2 +-
+ 3 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/lib/decode.c b/lib/decode.c
+index bde967b..fd03fba 100644
+--- a/lib/decode.c
++++ b/lib/decode.c
+@@ -1747,13 +1747,13 @@ static void oc_dec_deblock_frag_rows(oc_dec_ctx *_dec,
+       flimit=(qstep*3)>>2;
+       oc_filter_hedge(dst+x,dst_ystride,src+x-src_ystride,src_ystride,
+        qstep,flimit,variance,variance+nhfrags);
+-      oc_filter_vedge(dst+x-(dst_ystride<<2)-4,dst_ystride,
++      oc_filter_vedge(dst+x-(dst_ystride*4)-4,dst_ystride,
+        qstep,flimit,variance-1);
+       variance++;
+       dc_qi++;
+     }
+-    dst+=dst_ystride<<3;
+-    src+=src_ystride<<3;
++    dst+=dst_ystride*8;
++    src+=src_ystride*8;
+   }
+   /*And finally, handle the last row in the frame, if it's in the range.*/
+   if(!notdone){
+@@ -1769,7 +1769,7 @@ static void oc_dec_deblock_frag_rows(oc_dec_ctx *_dec,
+     for(x=8;x<width;x+=8){
+       qstep=_dec->pp_dc_scale[*dc_qi++];
+       flimit=(qstep*3)>>2;
+-      oc_filter_vedge(dst+x-(dst_ystride<<3)-4,dst_ystride,
++      oc_filter_vedge(dst+x-(dst_ystride*8)-4,dst_ystride,
+        qstep,flimit,variance++);
+     }
+   }
+@@ -1944,7 +1944,7 @@ static void oc_dec_dering_frag_rows(oc_dec_ctx *_dec,th_img_plane *_img,
+       frag++;
+       variance++;
+     }
+-    idata+=ystride<<3;
++    idata+=ystride*8;
+   }
+ }
+ 
+@@ -2877,10 +2877,10 @@ int th_decode_ycbcr_out(th_dec_ctx *_dec,th_ycbcr_buffer _ycbcr){
+             u_row[x>>1]=OC_CLAMP255(u);
+             v_row[x>>1]=OC_CLAMP255(v);
+           }
+-          y_row+=_ycbcr[0].stride<<1;
++          y_row+=_ycbcr[0].stride*2;
+           u_row+=_ycbcr[1].stride;
+           v_row+=_ycbcr[2].stride;
+-          rgb_row+=cstride<<1;
++          rgb_row+=cstride*2;
+         }
+       }break;
+       case TH_PF_422:{
+diff --git a/lib/state.c b/lib/state.c
+index 42ed33a..fe803d6 100644
+--- a/lib/state.c
++++ b/lib/state.c
+@@ -573,7 +573,7 @@ static int oc_state_ref_bufs_init(oc_theora_state *_state,int _nrefs){
+         frag_buf_offs[fragi]=hpix-ref_frame_data;
+         hpix+=8;
+       }
+-      vpix+=stride<<3;
++      vpix+=stride*8;
+     }
+   }
+   /*Initialize the reference frame indices.*/
+@@ -1055,7 +1055,7 @@ void oc_state_loop_filter_frag_rows_c(const oc_theora_state *_state,int *_bv,
+           loop_filter_h(ref+8,ystride,_bv);
+         }
+         if(fragi+nhfrags<fragi_bot&&!frags[fragi+nhfrags].coded){
+-          loop_filter_v(ref+(ystride<<3),ystride,_bv);
++          loop_filter_v(ref+(ystride*8),ystride,_bv);
+         }
+       }
+       fragi++;
+diff --git a/lib/x86/mmxfrag.c b/lib/x86/mmxfrag.c
+index 2c73293..6930aaf 100644
+--- a/lib/x86/mmxfrag.c
++++ b/lib/x86/mmxfrag.c
+@@ -141,7 +141,7 @@ void oc_frag_recon_intra_mmx(unsigned char *_dst,int _ystride,
+     :
+     :[residue]"r"(_residue),
+      [dst]"r"(_dst),
+-     [dst4]"r"(_dst+(_ystride<<2)),
++     [dst4]"r"(_dst+(_ystride*4)),
+      [ystride]"r"((ptrdiff_t)_ystride),
+      [ystride3]"r"((ptrdiff_t)_ystride*3)
+     :"memory"
+-- 
+2.27.0
+
+From 62b266ae4e2465ab24b5ed4761044e2af3015fee Mon Sep 17 00:00:00 2001
+From: Petter Reinholdtsen <pere@debian.org>
+Date: Sun, 9 Mar 2025 08:11:17 +0100
+Subject: [PATCH 2/3] Made mask unsigned to avoid shifting into sign bit.
+
+The last iteration of the loop execute 1<<63, which would push the
+result into the signed bit of a signed 64 bit type, and this
+move into currently undefined behaviour with C99.  Avoid the
+issue by making the operation work on unsigned 64 bit type instead.
+
+This require libogg version to 1.3.4, raise autotools dependency check
+to look for this.
+
+Partly solves github issue #18.
+
+Backported to 1.1.1 by <wangshuo@kylinos.cn>, fix CVE-2024-56431
+https://github.com/xiph/theora/commit/62b266ae4e2465ab24b5ed4761044e2af3015fee
+---
+ configure.ac | 4 ++--
+ lib/state.c  | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 8260bdf..078ec13 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -268,7 +268,7 @@ dnl check for pkg-config itself so we don't try the m4 macro without pkg-config
+ AC_CHECK_PROG(HAVE_PKG_CONFIG, pkg-config, yes)
+ if test "x$HAVE_PKG_CONFIG" = "xyes"
+ then
+-  PKG_CHECK_MODULES(OGG, ogg >= 1.1, HAVE_OGG=yes, HAVE_OGG=no)
++  PKG_CHECK_MODULES(OGG, ogg >= 1.3.4, HAVE_OGG=yes, HAVE_OGG=no)
+ fi
+ if test "x$HAVE_OGG" = "xno"
+ then
+@@ -283,7 +283,7 @@ then
+   CFLAGS="$CFLAGS $OGG_CFLAGS"
+   LIBS="$LIBS $OGG_LIBS"
+   AC_CHECK_FUNC(oggpackB_read, , [
+-    AC_MSG_ERROR([newer libogg version (1.1 or later) required])
++    AC_MSG_ERROR([newer libogg version (1.3.4 or later) required])
+   ])
+   CFLAGS=$cflags_save
+   LIBS=$libs_save
+diff --git a/lib/state.c b/lib/state.c
+index fe803d6..1deb4b0 100644
+--- a/lib/state.c
++++ b/lib/state.c
+@@ -316,7 +316,7 @@ static void oc_state_border_init(oc_theora_state *_state){
+         /*Otherwise, check to see if it straddles the border.*/
+         else if(x<crop_x0&&crop_x0<x+8||x<crop_xf&&crop_xf<x+8||
+          y<crop_y0&&crop_y0<y+8||y<crop_yf&&crop_yf<y+8){
+-          ogg_int64_t mask;
++          ogg_uint64_t mask;
+           int         npixels;
+           int         i;
+           mask=npixels=0;
+@@ -324,7 +324,7 @@ static void oc_state_border_init(oc_theora_state *_state){
+             int j;
+             for(j=0;j<8;j++){
+               if(x+j>=crop_x0&&x+j<crop_xf&&y+i>=crop_y0&&y+i<crop_yf){
+-                mask|=(ogg_int64_t)1<<(i<<3|j);
++                mask|=(ogg_uint64_t)1<<(i<<3|j);
+                 npixels++;
+               }
+             }
+-- 
+2.27.0
+
+From ec642ecf6d94f11d5eb05ab1fb7a9728c9a89cae Mon Sep 17 00:00:00 2001
+From: Petter Reinholdtsen <pere@debian.org>
+Date: Sun, 9 Mar 2025 22:53:57 +0100
+Subject: [PATCH 3/3] Replaced more possible bit shifting into signed bit of
+ stride values.
+
+Leftover changes from a6766c94721bc55e8e56fb0d941ecfe2d27c3d17.
+
+Use multiplication instead, allowing the compiler to optimize to
+bitshifts if it believe it to be safe.
+
+Partly solves github issue #18.
+
+Backported to 1.1.1 by <wangshuo@kylinos.cn>, fix CVE-2024-56431
+https://github.com/xiph/theora/commit/ec642ecf6d94f11d5eb05ab1fb7a9728c9a89cae
+---
+ lib/x86/mmxstate.c    | 2 +-
+ lib/x86_vc/mmxstate.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/x86/mmxstate.c b/lib/x86/mmxstate.c
+index 808b0a7..dd428d6 100644
+--- a/lib/x86/mmxstate.c
++++ b/lib/x86/mmxstate.c
+@@ -176,7 +176,7 @@ void oc_state_loop_filter_frag_rows_mmx(const oc_theora_state *_state,
+           OC_LOOP_FILTER_H_MMX(ref+8,ystride,ll);
+         }
+         if(fragi+nhfrags<fragi_bot&&!frags[fragi+nhfrags].coded){
+-          OC_LOOP_FILTER_V_MMX(ref+(ystride<<3),ystride,ll);
++          OC_LOOP_FILTER_V_MMX(ref+(ystride*8),ystride,ll);
+         }
+       }
+       fragi++;
+diff --git a/lib/x86_vc/mmxstate.c b/lib/x86_vc/mmxstate.c
+index 73bd198..8a00909 100644
+--- a/lib/x86_vc/mmxstate.c
++++ b/lib/x86_vc/mmxstate.c
+@@ -193,7 +193,7 @@ void oc_state_loop_filter_frag_rows_mmx(const oc_theora_state *_state,
+           OC_LOOP_FILTER_H_MMX(ref+8,ystride,ll);
+         }
+         if(fragi+nhfrags<fragi_bot&&!frags[fragi+nhfrags].coded){
+-          OC_LOOP_FILTER_V_MMX(ref+(ystride<<3),ystride,ll);
++          OC_LOOP_FILTER_V_MMX(ref+(ystride*8),ystride,ll);
+         }
+ #undef PIX
+ #undef YSTRIDE3
+-- 
+2.27.0
+
+

libtheora.spec

@@ -1,19 +1,20 @@
 Name:           libtheora
 Version:        1.1.1
-Release:        24
+Release:        28
 Summary:        Theora Video Compression
 License:        BSD
 Epoch:          1
 URL:            http://www.theora.org
 Source0:        http://downloads.xiph.org/releases/theora/%{name}-%{version}.tar.xz
 
-BuildRequires:  autoconf automake libtool SDL-devel libpng-devel doxygen
+BuildRequires:  autoconf automake libtool SDL-devel libpng-devel doxygen perl-Git
 BuildRequires:  libogg-devel >= 2:1.1
 BuildRequires:  libvorbis-devel tetex-latex transfig
 
 Patch0:         Fix-pp_sharp_mod-calculation.patch
 Patch1:         examples-fix-underlinking.patch
 Patch2:         examples-png_sizeof-no-longer-available-since-libpng.patch
+Patch3:         backport-fix-CVE-2024-56431.patch
 
 %description
 Theora is a free and open video compression format from the Xiph.org Foundation. Like all
@@ -59,7 +60,7 @@ use with theora bitstreams.
 
 
 %prep
-%autosetup -n %{name}-%{version} -p1 -Sgit
+%autosetup -n %{name}-%{version} -p1
 
 sed -i 's/CFLAGS="$CFLAGS $cflags_save"/CFLAGS="$cflags_save"/g' configure
 cp /usr/lib/rpm/config.* .
@@ -81,7 +82,9 @@ rm -rf $RPM_BUILD_ROOT/%{_docdir}/
 mkdir -p $RPM_BUILD_ROOT/%{_bindir}
 install -m 755 examples/.libs/dump_video $RPM_BUILD_ROOT/%{_bindir}/theora_dump_video
 install -m 755 examples/.libs/encoder_example $RPM_BUILD_ROOT/%{_bindir}/theora_encode
+%ifnarch sw_64
 install -m 755 examples/.libs/player_example $RPM_BUILD_ROOT/%{_bindir}/theora_player
+%endif
 install -m 755 examples/.libs/png2theora $RPM_BUILD_ROOT/%{_bindir}/png2theora
 
 %ldconfig_scriptlets
@@ -104,6 +107,18 @@ install -m 755 examples/.libs/png2theora $RPM_BUILD_ROOT/%{_bindir}/png2theora
 %{_bindir}/*
 
 %changelog
+* Fri Mar 21 2025 wangshuo <wangshuo@kylinos.cn> - 1:1.1.1-28
+- Fix CVE-2024-56431, fix changelog format
+
+* Tue Mar 18 2025 mahailiang <mahailiang@uniontech.com> - 1:1.1.1-27
+- fix sw_64 build error
+
+* Fri Jul 30 2021 chenyanpanHW <chenyanpan@huawei.com> - 1:1.1.1-26
+- DESC: delete -Sgit from %autosetup
+
+* Wed Jun 23 2021 wuchaochao <wuchaochao4@huawei.com> - 1:1.1.1-25
+- add buildrequires: perl-Git
+
 * Wed Jan 8 2020 openEuler Buildteam <buildteam@openeuler.org>  - 1:1.1.1-24
 - format patches
 

libtheora.yaml

@@ -0,0 +1,4 @@
+version_control: github
+src_repo: xiph/theora
+tag_prefix: ^v
+seperator: .